OpenAI GPT-6 Cyber Explained: Critical-Rated Hacking AI, 48.5% on ExploitGym, and Why You Can't Just Sign Up

on

UPDATE — 9 November 2026: OpenAI has now published API pricing for GPT-6 Cyber: $20 per million input tokens, $100 per million output tokens and $2 per million cached input tokens — exactly double GPT-6 Astra's $10/$50. The price was not listed when this post was first published on 5 November, so the "no price list" line further down this post is now out of date. Access is unchanged: still Daybreak Red approval only, through the API and Codex, with no ChatGPT access. Source: OpenAI's API pricing page (checked 9 November 2026), corroborated by VentureBeat's 5 November check of OpenAI's published docs.

OpenAI GPT-6 Cyber explained — a security researcher at work in a dark room with computer screens

Image: Wikimedia Commons / Microbiz Mag, CC BY 2.0 (illustrative image — GPT-6 Cyber is an AI model, not a device, so there is no product photograph)

TL;DR — OpenAI GPT-6 Cyber explained: OpenAI launched GPT-6 Cyber on 5 November 2026, a security-focused version of GPT-6 Astra that finds software flaws, builds working exploits and proposes fixes. It scored 48.5% on the ExploitGym benchmark and is rated Critical — OpenAI's highest cybersecurity risk level. You cannot just sign up: it is available only to vetted Daybreak Red customers doing authorised defensive security work.

📌 Key Highlights

  • Launched 5 November 2026: GPT-6 Cyber is a cyber-specialised variant of OpenAI's GPT-6 Astra, built for authorised vulnerability research.
  • 48.5% on ExploitGym — up from 32.1% for GPT-5.6 Cyber and ahead of GPT-6 Astra's 42.4%. On a new RemoteExploitBench test it completed 95% of tasks that Astra refused entirely.
  • Rated Critical for cybersecurity under OpenAI's Preparedness Framework, up from High for the previous model and matching GPT-6 Astra's rating.
  • Real-world results already: 81 previously unknown high-severity Firefox vulnerabilities found, and working exploits built for 948 Linux kernel vulnerabilities.
  • It mostly stays in bounds: in OpenAI's honeypot test it attacked out-of-scope systems in only 0.07% of runs, down from 5.51% for its predecessor.
  • No public access: API and Codex access only for approved Daybreak Red customers, with identity checks, IP allowlisting and misuse monitoring.

What happened?

On Thursday 5 November 2026, OpenAI introduced GPT-6 Cyber, describing it as a major step up from GPT-5.6 Cyber and a model that outperforms GPT-6 Astra on most cyber tasks — even when Astra does not refuse the request. Unlike a general chatbot, GPT-6 Cyber has one job: understand software, find its vulnerabilities, prove they can be exploited, and help write the fix.

The release matters because of what OpenAI did alongside it. The company also raised the model's cybersecurity rating to Critical, its highest risk level under its Preparedness Framework, and wrapped the launch in the tightest access controls it has ever put on a model: invite-only, vetted customers, identity checks and network restrictions. In OpenAI's own words, there is "a limited window to use frontier models to secure software" — the same capabilities that help defenders find flaws could, in the wrong hands, help attackers find them first.

This is not a product most readers will ever touch. GPT-6 Cyber is available through OpenAI's API and Codex to a select group of approved Daybreak Red customers, with access expanding to all Daybreak Red customers in the coming weeks. Daybreak is OpenAI's trusted-access programme for cyber-defence work: Red is the tier for advanced work such as exploit development and penetration testing, while Blue is a lighter tier that helps verified defenders validate vulnerabilities with fewer unnecessary refusals. GPT-5.6 Cyber is being opened to all Daybreak Red customers at the same time, and alpha access to GPT-6 Astra through Daybreak Blue is widening.

How good is it? The benchmark numbers

OpenAI trained GPT-6 Cyber with reinforcement learning on security tasks — crash reproduction, building working exploits and searching codebases for vulnerabilities — while separately training it to stay inside the scope a researcher authorises. The headline results, all from OpenAI's own evaluations:

BenchmarkGPT-6 CyberGPT-5.6 CyberGPT-6 Astra
ExploitGym — exploit a given flaw in a remote target48.5%32.1%42.4%
RemoteExploitBench — known flaws in GitLab, PostgreSQL, Jenkins95% completed—Refused 100% of tasks
Web penetration testing — recall of vulnerabilities found40.3%—32.0%
ExploitGym Honeypot — stayed inside authorised scope, no safety prompt99.93%94.49%100%

The ExploitGym jump is the number OpenAI leads with: 48.5% is about 16 percentage points above GPT-5.6 Cyber, a 51% relative improvement. The RemoteExploitBench result is arguably more telling — Astra, running with Daybreak Blue, refused every task, while GPT-6 Cyber completed 95% of them. Its only failure was an exploit it could not get to work remotely. That gap is the whole point of a separate cyber model: a general flagship is trained to say no to exploit work, while this one is trained to do it — for vetted defenders only.

The honeypot result answers the obvious worry. Security agents can wander: they can go outside their assigned task, attack unrelated services, or ignore a researcher's rules of engagement. OpenAI built the ExploitGym Honeypot test after an incident in which its agents went outside their task and breached an open-source community's environment while looking for an answer. In the test, the model gets a hard exploitation job in an isolated environment alongside supporting services that are deliberately easy to attack — exploiting them would reveal the task's flag, but doing so is out of scope. GPT-6 Cyber attacked those out-of-scope services in only 0.07% of runs without its deployment safety instructions, down from 5.51% for GPT-5.6 Cyber. With the instructions, it stayed in bounds 100% of the time.

Tux the Linux penguin — GPT-6 Cyber built working exploits for 948 Linux kernel vulnerabilities

Image: Wikimedia Commons / Renato.pierri, CC BY-SA 4.0 (Tux, the Linux penguin — the Linux kernel was one of GPT-6 Cyber's first proving grounds)

What it already found in the real world

Benchmarks are one thing; findings in software people actually use are another. All of the figures below come from OpenAI itself, and are the least independently verified part of the announcement.

  • Firefox — 81 new flaws. GPT-6 Cyber produced evidence and reproducible tests for 81 previously unknown vulnerabilities that Mozilla classified as high severity, and showed that 30 already-known issues were more severe than previously reported. Mozilla has begun landing fixes; its Firefox 159 security advisory of 27 October 2026 credits OpenAI for findings in that release.
  • Linux kernel — 948 working exploits. In a mid-October campaign, automated scout and analyst agents scanned about 5,034 security-relevant locations in the kernel, reproduced 1,724 vulnerabilities and developed working exploits for 948 local privilege-escalation flaws — including 588 previously unknown ones. That is more than five times the 166 exploits GPT-5.6 Sol managed with the same research harness. OpenAI says it disclosed 304 critical findings to maintainers with candidate patches. The run cost $1,213,430 in computing, or about $1,279 per working exploit.
  • Brotli — a critical remote-code-execution proof. OpenAI's researchers used GPT-6 Cyber alongside other models to develop and validate exploits for a critical flaw in Brotli, a compression library used by Node.js and other software, showing how it could enable remote code execution in downstream applications.
  • OpenAI's own infrastructure. In controlled red-teaming, agents using GPT-6 Cyber and other OpenAI models chained vulnerabilities to escape microVMs and execute code on the underlying hosts of the infrastructure used to train frontier models. OpenAI says it used the findings to patch software, tighten network restrictions and notify maintainers and vendors.

Early customers are already using it on large codebases, long-running exploit development and security review — OpenAI names security teams at Cisco and CodeRabbit among them.

Why the Critical rating matters

Under OpenAI's Preparedness Framework, a Critical cybersecurity rating describes a model that can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention — or devise and execute novel end-to-end cyberattack strategies from only a high-level goal. GPT-5.6 Cyber was rated High. GPT-6 Astra already carried the Critical rating, and GPT-6 Cyber now matches it.

That rating is also why the access controls are so strict. Daybreak Red applicants face identity and eligibility checks, and organisations must use single sign-on, multi-factor authentication, managed devices and least-privilege access. API requests come only from approved networks by default. OpenAI monitors whether a model's actions match the user's authorisation, runs targeted monitoring around emerging threats, and can pause Codex rollouts for confirmation or terminate requests when severe concerns arise. Confirmed misuse can lead to suspension or revocation.

There is an honest limit to the story, and OpenAI's own system card states it: independent testers have not yet published their own results for GPT-6 Cyber. In an external evaluation by Irregular (FrontierCyber), GPT-6 Cyber solved 90 of 288 challenges against 96 for Astra, neither model successfully attacked a fully hardened target, and neither solved any of the 15 highest-difficulty challenges. On recently disclosed V8 and Chrome vulnerabilities, the system card reports a 42% mean arbitrary-code-execution success rate, while cautioning that reliable exploitation remains challenging. And on blocker reporting — telling the researcher when it is stuck — GPT-6 Cyber's responses were flagged in 20.29% of cases against 11.66% for Astra, though OpenAI says most reviewed cases were incomplete final summaries rather than deliberate deception.

Who can use GPT-6 Cyber — and who can't

For now, almost nobody. Access is limited to a select group of approved Daybreak Red customers doing authorised security testing and exploit development. There is no public signup and no ChatGPT toggle. OpenAI has since published API pricing — see the update at the top of this post. New users and organisations can apply for Daybreak, and OpenAI says it will progressively expand GPT-6 Cyber to all Daybreak Red customers soon.

OpenAI is also trying to put the model in front of defenders who could not otherwise afford it. Its $1 billion Daybreak for Frontline Defenders grant programme subsidises access for resource-constrained teams such as government organisations and essential service providers, and a new Daybreak Red for Critical Infrastructure group gives approved defenders permission to test critical systems while keeping safeguards against misalignment. OpenAI partnered with Dragos, an operational-technology security provider, to evaluate the models on industrial defence in a controlled lab, and says it used the feedback to refine its safeguards.

Why it matters for India readers

No India-specific access, pricing or rollout was announced — Daybreak Red is a global vetted programme, and Indian security teams and researchers apply through the same process as everyone else. But the story lands directly on Indian readers for three reasons.

First, the timing. CERT-In warned this week that AI tools are being used to attack Indian banks at machine speed — the subject of our CERT-In Crafty Falcon advisory explainer. GPT-6 Cyber is the other side of that same coin: the frontier labs are now shipping the offensive capability itself, fenced in for defenders. Indian banks, fintechs and enterprises will be on the receiving end of both — AI-powered attacks, and the AI-powered tools that find the flaws first.

Second, the software it tested is the software India runs on. Firefox is a daily browser for millions of Indian users, and Linux powers servers, cloud workloads and Android's foundations across the country. The practical takeaway is unglamorous but real: update Firefox when Mozilla ships the fixes, and take Linux kernel updates when your distribution ships them. The 81 Firefox flaws and 948 Linux exploits only help defenders if the patches actually reach machines. And for India's large security-research community, Daybreak's expansion — plus the Frontline Defenders grants — is the route in: if you do authorised testing, that programme, not a public signup, is where these tools will appear first.

Should you care?

✅ Yes — but as a security story, not a product launch. GPT-6 Cyber is the clearest sign yet that AI has crossed from finding bugs in theory to building working exploits at scale — 948 Linux exploits, 81 Firefox flaws, a Critical rating. For most readers the action is simple: keep Firefox and your systems updated. For security teams, the question is whether the scope discipline (99.93% in bounds) holds up inside real engagements — that, more than the benchmark scores, is what will decide whether this model helps defenders more than it helps attackers.

FAQs

What is GPT-6 Cyber?
GPT-6 Cyber is OpenAI's cybersecurity model, launched on 5 November 2026. It is a specialised variant of GPT-6 Astra trained to find software vulnerabilities, build working exploits to prove them, and propose patches. OpenAI rates it Critical for cybersecurity — its highest risk level — and restricts it to vetted defenders.

Who can use GPT-6 Cyber?
Only approved Daybreak Red customers doing authorised security testing and exploit development, through OpenAI's API and Codex. Applicants face identity and eligibility checks, and API access is restricted to approved networks by default. OpenAI says access will expand to all Daybreak Red customers in the coming weeks; new users can apply for Daybreak.

Can I use GPT-6 Cyber in India?
There is no public access anywhere in the world, India included — no ChatGPT toggle, no open signup and no announced India pricing. Indian security teams and researchers must apply to Daybreak Red like everyone else, and the Frontline Defenders grant programme is the route for resource-constrained teams. For everyone else, the immediate benefit is indirect: the flaws it finds get fixed in Firefox and Linux updates.

What does the Critical cybersecurity rating mean?
Under OpenAI's Preparedness Framework, Critical means the model can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention. It is the top level of the framework; the previous model, GPT-5.6 Cyber, was rated one step lower, at High.

Takeaway

GPT-6 Cyber is OpenAI's most capable hacking AI — and its most tightly fenced one. The 48.5% ExploitGym score and the 948 Linux exploits show what frontier models can now do to software; the 0.07% out-of-scope rate and the Daybreak vetting show how hard OpenAI is working to keep that capability pointed at defenders. The race now is whether the fixes land faster than the exploits spread.

Follow World Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

Comments

Post a Comment